Overview
overview
10Static
static
10COMDLG32.dll
windows7-x64
1COMDLG32.dll
windows10-2004-x64
1Programs/HexEdit.exe
windows7-x64
7Programs/HexEdit.exe
windows10-2004-x64
7Programs/I...LL.dll
windows7-x64
3Programs/I...LL.dll
windows10-2004-x64
3Programs/I...er.exe
windows7-x64
1Programs/I...er.exe
windows10-2004-x64
1Programs/I...er.dll
windows7-x64
6Programs/I...er.dll
windows10-2004-x64
6Programs/I...te.dll
windows7-x64
1Programs/I...te.dll
windows10-2004-x64
1Programs/I...32.dll
windows7-x64
3Programs/I...32.dll
windows10-2004-x64
3Programs/I...pt.dll
windows7-x64
1Programs/I...pt.dll
windows10-2004-x64
1Programs/I...39.dll
windows7-x64
3Programs/I...39.dll
windows10-2004-x64
3Programs/I...39.dll
windows7-x64
3Programs/I...39.dll
windows10-2004-x64
3Programs/I...39.dll
windows7-x64
3Programs/I...39.dll
windows10-2004-x64
3Programs/I...39.dll
windows7-x64
1Programs/I...39.dll
windows10-2004-x64
1Programs/I...39.dll
windows7-x64
3Programs/I...39.dll
windows10-2004-x64
3Programs/I...ge.dll
windows7-x64
3Programs/I...ge.dll
windows10-2004-x64
3Programs/I...de.pdf
windows7-x64
1Programs/I...de.pdf
windows10-2004-x64
1Programs/I...40.dll
windows7-x64
1Programs/I...40.dll
windows10-2004-x64
1Analysis
-
max time kernel
117s -
max time network
199s -
platform
windows10-2004_x64 -
resource
win10v2004-20231023-en -
resource tags
arch:x64arch:x86image:win10v2004-20231023-enlocale:en-usos:windows10-2004-x64system -
submitted
07-11-2023 14:11
Behavioral task
behavioral1
Sample
COMDLG32.dll
Resource
win7-20231020-en
windows7-x64
Behavioral task
behavioral2
Sample
COMDLG32.dll
Resource
win10v2004-20231023-en
windows10-2004-x64
Behavioral task
behavioral3
Sample
Programs/HexEdit.exe
Resource
win7-20231023-en
windows7-x64
Behavioral task
behavioral4
Sample
Programs/HexEdit.exe
Resource
win10v2004-20231023-en
windows10-2004-x64
Behavioral task
behavioral5
Sample
Programs/Imager/ADIsoDLL.dll
Resource
win7-20231023-en
windows7-x64
Behavioral task
behavioral6
Sample
Programs/Imager/ADIsoDLL.dll
Resource
win10v2004-20231023-en
windows10-2004-x64
Behavioral task
behavioral7
Sample
Programs/Imager/FTKImager.exe
Resource
win7-20231023-en
windows7-x64
Behavioral task
behavioral8
Sample
Programs/Imager/FTKImager.exe
Resource
win10v2004-20231023-en
windows10-2004-x64
Behavioral task
behavioral9
Sample
Programs/Imager/IsoBuster.dll
Resource
win7-20231020-en
windows7-x64
Behavioral task
behavioral10
Sample
Programs/Imager/IsoBuster.dll
Resource
win10v2004-20231023-en
windows10-2004-x64
Behavioral task
behavioral11
Sample
Programs/Imager/MD5Remote.dll
Resource
win7-20231023-en
windows7-x64
Behavioral task
behavioral12
Sample
Programs/Imager/MD5Remote.dll
Resource
win10v2004-20231023-en
windows10-2004-x64
Behavioral task
behavioral13
Sample
Programs/Imager/ProfUIS284ad32.dll
Resource
win7-20231023-en
windows7-x64
Behavioral task
behavioral14
Sample
Programs/Imager/ProfUIS284ad32.dll
Resource
win10v2004-20231023-en
windows10-2004-x64
Behavioral task
behavioral15
Sample
Programs/Imager/adencrypt.dll
Resource
win7-20231020-en
windows7-x64
Behavioral task
behavioral16
Sample
Programs/Imager/adencrypt.dll
Resource
win10v2004-20231023-en
windows10-2004-x64
Behavioral task
behavioral17
Sample
Programs/Imager/boost_date_time-vc90-mt-1_39.dll
Resource
win7-20231023-en
windows7-x64
Behavioral task
behavioral18
Sample
Programs/Imager/boost_date_time-vc90-mt-1_39.dll
Resource
win10v2004-20231020-en
windows10-2004-x64
Behavioral task
behavioral19
Sample
Programs/Imager/boost_filesystem-vc90-mt-1_39.dll
Resource
win7-20231020-en
windows7-x64
Behavioral task
behavioral20
Sample
Programs/Imager/boost_filesystem-vc90-mt-1_39.dll
Resource
win10v2004-20231020-en
windows10-2004-x64
Behavioral task
behavioral21
Sample
Programs/Imager/boost_regex-vc90-mt-1_39.dll
Resource
win7-20231020-en
windows7-x64
Behavioral task
behavioral22
Sample
Programs/Imager/boost_regex-vc90-mt-1_39.dll
Resource
win10v2004-20231023-en
windows10-2004-x64
Behavioral task
behavioral23
Sample
Programs/Imager/boost_system-vc90-mt-1_39.dll
Resource
win7-20231020-en
windows7-x64
Behavioral task
behavioral24
Sample
Programs/Imager/boost_system-vc90-mt-1_39.dll
Resource
win10v2004-20231025-en
windows10-2004-x64
Behavioral task
behavioral25
Sample
Programs/Imager/boost_thread-vc90-mt-1_39.dll
Resource
win7-20231020-en
windows7-x64
Behavioral task
behavioral26
Sample
Programs/Imager/boost_thread-vc90-mt-1_39.dll
Resource
win10v2004-20231020-en
windows10-2004-x64
Behavioral task
behavioral27
Sample
Programs/Imager/cximage.dll
Resource
win7-20231025-en
windows7-x64
Behavioral task
behavioral28
Sample
Programs/Imager/cximage.dll
Resource
win10v2004-20231020-en
windows10-2004-x64
Behavioral task
behavioral29
Sample
Programs/Imager/help/enu/ImagerUsersGuide.pdf
Resource
win7-20231025-en
windows7-x64
Behavioral task
behavioral30
Sample
Programs/Imager/help/enu/ImagerUsersGuide.pdf
Resource
win10v2004-20231020-en
windows10-2004-x64
Behavioral task
behavioral31
Sample
Programs/Imager/icudt40.dll
Resource
win7-20231020-en
windows7-x64
Behavioral task
behavioral32
Sample
Programs/Imager/icudt40.dll
Resource
win10v2004-20231020-en
windows10-2004-x64
General
-
Target
Programs/Imager/IsoBuster.dll
-
Size
1.7MB
-
MD5
93cdf7be2ecb3f4487356f9bfc364c1f
-
SHA1
dd239f081cadbccea07397b2ea39fd94cbee5b16
-
SHA256
8b9803a86c79f89dc1e831081407fa45b3ce480b3169fd19f90aa0e638323eb0
-
SHA512
1b5cfc72a11673557e37372e9e6861196c8596628c786503c38003d91f3df2412b3496ce5ed75abf7647fdd230efb3b3e1a38f55d0540d0f38fb22ca2328f084
-
SSDEEP
24576:ISZ+l75FT4yjCY89RG6WEDCK97dc0Y0DM1yUk/DYz8bavv1GPZBisOquj17vbTkz:2J5qyOlL7WN0DM1yU2szRRXqU9DpTYSk
Malware Config
Signatures
-
Enumerates connected drives 3 TTPs 21 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\I: rundll32.exe File opened (read-only) \??\L: rundll32.exe File opened (read-only) \??\M: rundll32.exe File opened (read-only) \??\Q: rundll32.exe File opened (read-only) \??\S: rundll32.exe File opened (read-only) \??\T: rundll32.exe File opened (read-only) \??\Y: rundll32.exe File opened (read-only) \??\Z: rundll32.exe File opened (read-only) \??\H: rundll32.exe File opened (read-only) \??\K: rundll32.exe File opened (read-only) \??\P: rundll32.exe File opened (read-only) \??\U: rundll32.exe File opened (read-only) \??\V: rundll32.exe File opened (read-only) \??\G: rundll32.exe File opened (read-only) \??\J: rundll32.exe File opened (read-only) \??\O: rundll32.exe File opened (read-only) \??\X: rundll32.exe File opened (read-only) \??\E: rundll32.exe File opened (read-only) \??\N: rundll32.exe File opened (read-only) \??\R: rundll32.exe File opened (read-only) \??\W: rundll32.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 3384 wrote to memory of 448 3384 rundll32.exe 89 PID 3384 wrote to memory of 448 3384 rundll32.exe 89 PID 3384 wrote to memory of 448 3384 rundll32.exe 89
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\Programs\Imager\IsoBuster.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:3384 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\Programs\Imager\IsoBuster.dll,#12⤵
- Enumerates connected drives
PID:448
-